Open Source Vulnerabilities

Microsoft.ChakraCore

ChakraCore RCE Vulnerability

github.com/argoproj/argo-cd

Argo Exposure of Sensitive Information

clamscan

Clamscan vulnerable to command injection

it.infuse.jenkins:usemango-runner

XSS vulnerability in Jenkins useMango Runner Plugin

io.jenkins.plugins:code-coverage-api

XXE vulnerability in Jenkins Code Coverage API Plugin

org.jenkins-ci.plugins:fitnesse

Stored XSS vulnerability in Jenkins FitNesse Plugin

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin

Reflected XSS vulnerability in Jenkins AWSEB Deployment Plugin

org.jenkins-ci.plugins:gatling

XSS vulnerability in Jenkins Gatling Plugin

xdlocalstorage

xdlocalstorage does not verify request origin

mediawiki/core, mediawiki/core, mediawiki/core

MediaWiki makeCollapsible allows applying event handler to any CSS selector

org.apache.dubbo:dubbo-rpc-http-invoker

Deserialization of Untrusted Data in Apache Dubbo

org.elasticsearch:elasticsearch, org.elasticsearch:elasticsearch

Improper Privilege Management in Elasticsearch

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Oauth 2 Insufficiently Protects Against Compromise

com.gradle.publish:plugin-publish-plugin, com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin

Exposure of Sensitive Information in Gradle publish plugin

org.codehaus.mevenide:netbeans

Improper Verification of Cryptographic Signature in Apache Netbeans

org.mule.modules:mule-apikit-module

Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Mulesoft APIkit

frozennode/administrator

FrozenNode Laravel-Administrator unrestricted file upload

python-apt, python-apt, python-apt, python-apt, python-apt

python-apt Does Not Check Hash Signature

python-apt, python-apt, python-apt, python-apt, python-apt

python-apt Flawed Package Integrity Check

org.jenkins-ci.plugins:azure-acs

RCE vulnerability in Jenkins Azure Container Service Plugin

org.jenkins-ci.plugins:rapiddeploy-jenkins

XXE vulnerability in Jenkins RapidDeploy Plugin

org.jenkins-ci.plugins:queue-cleanup

Reflected XSS vulnerability in Jenkins Queue cleanup Plugin

com.openshift.jenkins:openshift-pipeline

RCE vulnerability in Jenkins OpenShift Pipeline Plugin

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

org.jenkins-ci.plugins:artifactory

Passwords stored in plain text by Jenkins Artifactory Plugin

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Cross-Site Request Forgery in Jenkins

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

org.jenkins-ci.plugins:rapiddeploy-jenkins

Stored XSS vulnerability in Jenkins RapidDeploy Plugin

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Improper Neutralization of Input During Web Page Generation in Jenkins

de.taimos:pipeline-aws

RCE vulnerability in Jenkins Pipeline: AWS Steps Plugin

org.jenkins-ci.plugins:artifactory

Passwords transmitted in plain text by Jenkins Artifactory Plugin

codeigniter4/framework

CodeIgniter Improper Privilege Management

Autoupdater.NET.Official

AutoUpdater.NET allows XXE

ezsystems/ezpublish-kernel, ezsystems/ezpublish-legacy, ezsystems/ezpublish-kernel, ezsystems/ezpublish-kernel, ezsystems/ezpublish-legacy, ezsystems/ezpublish-legacy

eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin SQL Injection

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin SQL injection vulnerability

phpmyadmin/phpmyadmin, phpmyadmin/phpmyadmin

phpMyAdmin SQL injection vulnerability

com.liferay.portal:com.liferay.portal.kernel

Deserialization of Untrusted Data in Liferay Portal

phpbb/phpbb

phpBB arbitrary CSS injection

org.igniterealtime.openfire:parent

Ignite Realtime Openfire allows Cross-site Scripting

org.igniterealtime.openfire:parent

Ignite Realtime Openfire allows Cross-site Scripting

org.igniterealtime.openfire:parent

Ignite Realtime Openfire allows Cross-site Scripting

mantisbt/mantisbt

MantisBT XSS when uploading an attachment

org.igniterealtime.openfire:xmppserver

Ignite Realtime Openfire allows Cross-site Scripting

moodle/moodle, moodle/moodle, moodle/moodle

Moodle reflected Cross-site Scripting (XSS)

moodle/moodle, moodle/moodle

Moodle Email media URL tokens were not checking for user status

moodle/moodle

Moodle XSS Vulnerability

moodle/moodle, moodle/moodle, moodle/moodle

Moodle open redirect vulnerability

github.com/facebook/fbthrift

Golang Facebook Thrift servers vulnerable to denial of service

intelliants/subrion

Subrion CMS CSRF Vulnerability